Data Exposure Vulnerability in AshLua by Ash Project

CVE-2026-78216

What is CVE-2026-78216?

AshLua exposes read actions to Lua scripts executed through an eval action, allowing unauthorized access to sensitive data. The vulnerability arises because although Ash field policies effectively redact forbidden fields in returned records by replacing them with %Ash.ForbiddenField{}, this redaction does not extend to aggregate values. Consequently, a Lua script can access restricted fields by querying them as aggregates instead of regular fields, bypassing intended access controls. The corrective measures implemented ensure aggregation requests are authorized according to the resource's field policies, denying access when an actor should not be able to view the data or limiting visibility to authorized rows.

References